A SEO Analysis tool is showing cookie and token information publicly after fetching it from my website.

Is having this information from whithin my site's HTTP header published publicly safe? If it's not, how do I hide this from public view?

  • So a third party is making a request to your site and publicizing the results you sent them. Presumably their cookie and token is unique to them and shouldn't put your other users data in danger. – Stephen Ostermiller Mar 22 '16 at 0:55
  • Im not putting anyones data at risk, its info coming from the http header file on my site or any site I put in to analyze, I am not publishing this in my code at all – Vasko Mar 22 '16 at 0:58

Is showing cookie and token information publicly from within the HTTP header safe...

If the data is sensitive, then no.

Visit https://redbot.org/ and enter the URL of the page that sends the headers (that you are concerned about) to the browser. and you'll see them on that site.

...how do I hide this from public view?

Depends on what public means.

If it means clients who know nothing about technology, then good job!

If it means anyone or anything that scrapes whatever data they can get from a URL (such as crawlers), then your best bet is to encrypt at least the value of the header.

A header containing:

Set-cookie: Whatever=435435345acbedb45435

is far better than:

Set-cookie: Whatever=SecretCodeExposed

If you're page is generated from PHP, then consider using PHP sessions because it encodes your cookie values for you when passing values via HTTP.

If you're setting cookies manually, then at least encode the values if you want security.

  • thanks Mike, my set cookie is random numbers along with the token number. So I assume its safe for someone to go to the link you provided and analyse my website without exposing sensitive info that can be used to hack in to my website. With the random numbers I have for both cookie and token. – Vasko Mar 22 '16 at 1:03
  • 1
    Its safer than actual text that a hacker can use to gain access to something. Just don't go and tell the world the algorithm you used to encode the data. – Mike Mar 22 '16 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.